CompTIA Cloud Essentials+ (CLO-002)Governance, Risk, Compliance and SecurityMedium
A cloud service provider's data center requires all visitors to pass through a mantrap, present government-issued ID, and be escorted by an authorized employee before reaching the server floor. Which category of security control does this represent?
- ACompensating control
- BPhysical control
- CTechnical control
- DAdministrative control
Show answer & explanationAnswer & explanation
Correct answer: B. Physical control
Physical controls are security measures that protect physical access to facilities and equipment, such as mantraps, ID checks, badges, and escort requirements, which restrict who can physically reach sensitive infrastructure.
Why the other options are wrong
- A. A compensating control is an alternative measure used when a primary control cannot be implemented, not a category based on medium.
- C. Technical controls involve technology-based mechanisms like firewalls or encryption, not physical barriers.
- D. Administrative controls are policies and procedures (e.g., training, background checks), not physical barriers themselves.
Physical Control
A security control category that restricts or monitors physical access to facilities, equipment, or infrastructure, such as locks, mantraps, badges, and security guards.
- Protects tangible assets and facility access
- Examples: mantraps, biometric scanners, fences, security guards
- Distinct from administrative (policy) and technical (technology) controls
- Often layered with technical controls for defense in depth
Memory trick: 'Physical = the walls and guards' protecting the building itself.